Topic starter
22/06/2026 1:41 pm
TL;DR: Zero Trust efforts still leave most organisations exposed because 87% experienced multiple identity-related breaches last year while many cannot see 56% of their machine identities, according to SPHERE Technology Solutions. The security model fails when identity visibility, ownership, and remediation remain incomplete across human and non-human populations.
Editorial analysis by NHI Mgmt Group, based on content published by SPHERE: “Building Zero Trust Identity Intelligence: The CISO’s Guide to Modern Identity Security Architecture”.
By the numbers:
- 87%+ of organisations experienced multiple identity-related breaches last year despite having Zero Trust initiatives in place.
- Most organisations cannot see 56% of their machine identities.
Key questions
Q: What breaks when machine identities are excluded from Zero Trust policy?
A: Zero Trust breaks when machine identities are excluded because service accounts and workloads often generate the highest-volume internal access.
Q: Why do privileged service accounts increase data breach risk in Zero Trust models?
A: Privileged service accounts often hold broad, persistent access that bypasses the containment benefits Zero Trust is trying to create.
Q: How do security teams know behavioral identity intelligence is actually working?
A: It is working when teams see fewer false positives, faster identification of credible anomalies, and better separation between harmless deviation and real threat.
Practitioner guidance
- Define a continuous identity discovery baseline Inventory human and non-human identities across directories, cloud platforms, databases, and infrastructure, then classify which ones are owned, orphaned, privileged, or stale.
- Map ownership for every privileged non-human identity Assign a validated owner to each service account, API key, token, and automation credential, and revoke access where ownership cannot be established.
- Prioritise remediation by identity blast radius Rank accounts by privilege, sensitivity, and cross-platform reach so the first cleanup pass targets identities that can cause the widest compromise.
Bottom line: Zero Trust initiatives do not fail only at the network edge. They fail when identities remain undiscovered, unowned, or too widely privileged to govern.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 1:46 pm
Identity intelligence is not a supplement to Zero Trust. It is the governance layer that makes Zero Trust operational. A Zero Trust architecture can verify access decisions only after it knows what identities exist and what risks they carry. When visibility is fragmented, the control stack becomes more reactive than preventive. The implication for practitioners is that identity governance has to start with discovery, ownership, and classification, not with policy enforcement alone.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Why does identity hygiene matter more when organisations move to zero trust?
A: Identity hygiene matters because zero trust replaces location-based trust with identity-based access decisions. If permissions are stale, overbroad, or poorly tracked, the identity layer becomes unreliable and the perimeter weakens. In hybrid environments, that can create hidden exposure even when network controls look intact, because access decisions depend on the quality of identity data.
👉 Read our full editorial: Identity intelligence is the missing layer in zero trust